CVE-2024-56563

What it actually does

A missing put_cred() call after get_current_cred() in ceph_mds_check_access() leaves an elevated credential reference count, causing a kernel credential leak.

Why it matters to the business

Systems using Ceph may experience gradual resource exhaustion or unexpected behavior in metadata server access checks; the listed PHP packages on older Ubuntu releases require immediate patching despite the kernel root cause.

How an attack unfolds

An attacker with access to trigger Ceph MDS operations causes repeated credential reference leaks; over time this can interfere with normal credential lifecycle management and potentially aid further kernel-level attacks, though no named threat actors or ransomware usage are associated.

How to fix it

Upgrade to the fixed package versions: php5 on Ubuntu 14.04 LTS to 5.5.9+dfsg-1ubuntu4.17 or php7.0 on Ubuntu 16.04 LTS to 7.0.4-7ubuntu2.1; apply the corresponding kernel update that resolves the cred leak in ceph_mds_check_access.

How to confirm the fix worked

Confirm the installed package versions match or exceed the listed fixed releases and verify the kernel source contains the put_cred() correction in ceph_mds_check_access.

Typical attack path

1. Identify a target running an affected Ceph-enabled kernel or the listed PHP packages
2. Trigger ceph_mds_check_access paths repeatedly via legitimate or crafted MDS operations
3. Accumulate leaked credential references leading to resource pressure or unexpected access behavior

How to detect it

Review kernel logs and audit trails for repeated ceph_mds_check_access entries or unusual credential-related warnings; no specific post-exploitation artifacts are known.

What your security team should do

• Prioritize patching the affected Ubuntu PHP and kernel packages within the next maintenance window
• Monitor EPSS and KEV status for any future elevation in exploit maturity
• Audit Ceph MDS workloads for anomalous access patterns until patches are deployed